Critical Alert: Stored XSS Threat in Advantech WISE-DeviceOn Server (CVE-2025-34262)

Overview

CVE-2025-34262 describes a stored Cross-Site Scripting (XSS) vulnerability affecting Advantech WISE-DeviceOn Server versions prior to 5.4. This flaw allows an authenticated attacker to inject malicious JavaScript code into device names, which is then executed in the browsers of other users interacting with the affected devices. This can lead to session hijacking and unauthorized actions, posing a significant security risk.

Technical Details

The vulnerability resides in the /rmm/v1/devices/name/{agent_id} endpoint. When an authenticated user renames a device, the new_name value is stored without proper HTML sanitization. Subsequently, this unsanitized name is rendered in device listings or detail views within the WISE-DeviceOn Server interface. An attacker can exploit this by injecting malicious JavaScript code within the new_name parameter. When other users view or interact with the device listing, the injected script will execute within their browser context.

Example attack vector:

        POST /rmm/v1/devices/name/12345 HTTP/1.1
        ...
        Content-Type: application/json

        {
            "new_name": "<script>alert('XSS Vulnerability!')</script>"
        }
        

CVSS Analysis

Currently, a CVSS score is not available (N/A). However, given the nature of a stored XSS vulnerability and the potential for session compromise, it’s likely to be classified as a medium to high severity issue once a score is assigned.

Possible Impact

Successful exploitation of this vulnerability can have severe consequences:

• Session Hijacking: An attacker could steal a user’s session cookie and gain unauthorized access to their account.
• Privilege Escalation: Depending on the user’s role, the attacker could perform actions they are not authorized to do, potentially gaining administrative privileges.
• Data Theft: Sensitive data displayed within the WISE-DeviceOn Server interface could be stolen.
• Malware Distribution: The attacker could inject malicious scripts that redirect users to phishing sites or download malware.
• Defacement: The attacker could modify the appearance of the WISE-DeviceOn Server interface, causing disruption and reputational damage.

Mitigation and Patch Steps

The recommended mitigation is to update to Advantech WISE-DeviceOn Server version 5.4 or later. This version includes a fix that properly sanitizes user input, preventing the injection of malicious scripts.

1. Upgrade WISE-DeviceOn Server: Download and install the latest version (5.4 or later) from the official Advantech website.
2. Verify Input Sanitization: After the update, verify that all user input fields, particularly those related to device names, are properly sanitized.
3. Monitor for Suspicious Activity: Continuously monitor your WISE-DeviceOn Server environment for any unusual or suspicious activity.

References

• Advantech Security Advisory
• Advantech WISE-DeviceOn Documentation
• VulnCheck Advisory